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@ An issue processing system for a right to use a resource. 



(§) The system operates in a data processing system having a global service program based on a 
fault-tolerant method providing a current processing server (2a) and a spare processing server (2b). The 
resource management server includes: a re-transmission examination unit (30) for examining a 
message from the processing server (2a) and determining whether it is a re-transmitted message, based 
on a discriminator attached to the message for requesting acquirement of the right to use the resource ; 
a discriminator addition unit (32) for adding the discriminator to the message for requesting the right to 
use to be issued when that right to use is registered ; and a right to use the examination unit (33) for 
examining whether the message is already registered based on a previous message for the re- 
transmission by referring to the discriminator attached by the discriminator addition unit when the 
message indicates the re-transmission message based on the detection of the re-transmission 
examination unit When the examination unit judges that the right to use is already registered, the above 
registered right to use is invalidated ; a new right to use is then registered into the nuclear program (4) 
and the new right to use is issued to the processing server (2b). 
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BACKGROUND OF THE INVENTION 

1 . Field of the Invention 

The present invention relates to an issue proces- 
sing system for a right to use a resource in a data pro- 
cessing system having a global service program 
based on a fault-tolerant method. More particularly, it 
relates to a system for rapidly processing an issue 
operation of a right to use a resource from a spare pro- 
cessing server to a resource management server in a 
data processing system employing a fault-tolerant 
method. 

2. Description of the Related Art 

In a data processing system, a global service pro- 
gram is provided for controlling all resources in the 
system, and a predetermined service is provided to an 
application program with reference to filed information 
in accordance with a processing of the global service 
program. In general, the global service program has 
a current system and a spare system to employ a 
fault-tolerant method. According to this fault-tolerant 
method, the application program does not detect the 
crash of the global service program. In this fault-toler- 
ant method, it is necessary for the spare global ser- 
vice program to rapidly open the file when the crash 
occurs In the current global program. 

That is, in the fault-tolerant method, there are pro- 
vided a current processing server and a spare proces- 
sing server in the system to take a countermeasure for 
an accident (for example, crash of a software in the 
current server) so that it is possible to continuously 
offer the service to the client. For example, when the 
accident occurs in the current processing server, the 
processing operations rapidly transferred from the 
current processing serve to the spare processing ser- 
ver. 

There are, however, some problems in the sys- 
tem employing the global service program.as exp- 
lained thereinafter. 

SUMMARY OF THE INVENTION 

In accordance with the present invention, there Is 
provided an issue processing system for a right to use 
a resource in a data processing system having a 
global service program based on a fault-tolerant 
method which provides a current processing server 
and a spare processing server, each processing ser- 
ver performs a predetermined data processing 
requested from client based on a resource acquired 
by a current resource management server, and the 
predetermined data processing is transferred from the 
current processing serverto the spare processing ser- 
ver based on a command of a transfer from nuclear 
program when a crash occurs in the current proces- 



sing server. The resource management server 
Includes: 

a re-transmission examination unit for examin- 
ing whether or not a message from the processing 
5 server is a re-transmitted message, based on a dis- 
criminator attached to the message for requesting 
acquirement of the right to use the resource; 

a discriminator addition unit for adding the dis- 
criminator to the message for requesting the right to 
10 use to be issued when that right to use is registered; 
and 

a right to use examination unit for examining 
whether or not the message is already registered 
based on a previous message for the re-transmission 

15 by referring the discriminator attached to the discrimi- 
nator addition unitwhen the massage indicates the re- 
transmission message based on the detection of the 
re-transmission examination unit; 

wherein, when the examination unit judges that 

20 the right to use is already registered, the above regis- 
tered right to use is invalidated, and the new right to 
use is registered into the nuclear program and the 
new right to use is issued to the processing server. 
In a preferred embodiment, the discriminator 

25 transmitted from the processing server to the 
resource management server is discriminated in 
accordance with a one-to-one discriminator and a re- 
transmission number discriminator for counting the 
number of the re-transmission, and the re-transmis- 

30 slon examination unit judges whether the message is 
the re-transmitted message based on the re-transmis- 
sion count discriminator. 

In a preferred embodiment, the one-to-one dis- 
criminator is uniformly constituted by a mulfr-discrimi- 

35 nator and an issue number counting discriminator, the 
multi-discriminator being multiplexedly used for the 
request of acquirement of the same resource, and 
issue number counting discriminator indicates the 
number of issues of the multi-discriminator. 

40 In accordance with the other aspect of the present 
invention, there is provided an issue processing sys- 
tem for a right to use a resource in a data processing 
system having a global service program based on a 
fault-tolerant method which provides a current service 

45 producing unit and a spare service producing unit, 
each service producing unit performing a predeter- 
mined data processing requested form a data proces- 
sing unit based on an access processing unit, and the 
predetermined data processing being transferred 

so from the current service producing unit to the spare 
service producing unit based on a command of a 
transfer from a supervisor when a crash occurs in the 
current service producing means, the system 
includes: 

65 a discriminator allocating unit for allocating the 

same discriminator to the current and spare service 
producing units; and 

a discriminator informing unit for informing the 
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discriminator allocated by the discriminator allocating 
unit to the access processing unit for processing a file 
access when the service producing unit issues the file 
opening request, 

wherein the access processing unit manages s 
the discriminator until the withdrawal of the opening 
environment is completed, the discriminator being 
informed from the current service producing unit at the 
timing of the file opening request therefrom, further, 
when the access processing unit manages the same 10 
discriminator as that of at the time of the file opening 
request based on the spare service producing unit, 
the opening environment defined by the discriminator 
is forcibly withdrawn; 

In a preferred embodiment, the discriminator is 
allocating unit allocates the same discriminator to 
both service producing means when the current and 
spare service producing means are started. 

BRIEF DESCRIPTION OF THE DRAWINGS zo 

In the drawings: 

Fig. 1 is a view explaining a fault-tolerant method 
by using message re-transmission in a conven- 
tional art; 25 
Fig. 2A and 2B are flowcharts for explaining the 
operation of the structure shown in Fig. 1; 
Fig. 3 is a view explaining an issue processing of 
a right to use; 

Figs. 4 to 7 are views explaining problems in a 30 
conventional art; 

Fig. 8 is a basic block diagram of an issue proces- 
sing system according to one aspect of the pre- 
sent Invention; 

Fig. 9 is a view for explaining processing steps of 35 
the structure shown in Fig. 8; 
Fig. 10 is a schematic block diagram of an issue 
processing system according to an embodiment 
of the present invention; 

Fig. 1 1 is one example of a discriminator accord- 40 
ing to the present invention; 
Figs. 12A and 12B are flowcharts for explaining 
the processing in a file name server; 
Figs. 13A and 13B are flowcharts for explaining 
the processing in a nuclear program; 45 
Figs. 14A and 14B are flowcharts for explaining 
the processing in a file management server; 
Fig. 15 is a view for explaining the processing 
operation in the system shown in Fig. 10; 
Fig. 16 is a schematic block diagram of a data pro- so 
cessing system having a global service program 
based on a fault-tolerance method; 
Fig. 17 is a view explaining the processing oper- 
ation when the crush occurs in the current OS2; 
Fig. 18 is a schematic block diagram of an issue 6S 
processing system according to another aspect 
of the present invention; 
Fig. 19 is a schematic block diagram according to 



one embodiment of the second aspect of the pre- 
sent invention shown in Fig. 18; 
Fig. 20 is a flowchart for explaining the processing 
operation in the file GS4; and 
Fig. 21 Is a view for explaining the processing 
operation according to the present invention. 

DESCRIPTION OF THE PREFERRED 
EMBODIMENTS 

Before describing the preferred embodiments, a 
explanation is given of a conventional art and its prob- 
lem. 

Figure 1 is a view for explaining a fault-tolerant 
method by using message re-transmission, and Fig- 
ures 2A and 2B are flowcharts for explaining the oper- 
ation of the structure shown in Fig. 1. 

In Fig. 1, reference number 1 denotes a client, 2a 
a current processing server, 2b a spare processing 
server, 3a a current resource managementserver, 3b 
a spare resource managementserver, and 4a nuclear 
program. In this system, the spare processing server 
2a and the spare resource management server 3b are 
used when the accident (for example, crash of a pro- 
gram) occurs in the current system. In general, the 
client is provided with a means for requesting a pre- 
determined service of the resource management ser- 
ver to utilize the resource, and, in general, the client 
is constituted by an application program. The 
resource management server manages the resource 
in order to provide the service. In this case, the pro- 
cessing server and the resource management server 
are provided by the global service program. 

In a normal processing, when a message for 
requesting a service is generated from the client 1 (1), 
the processing server 2a receives the message and 
requests the service from the resource management 
server 3a (2). The resource management server 3a 
receives the request of the service, and examines the 
message to determine if it is re-transmitted message 
(3). Further, in a resource managementserver 3a, the 
predetermined processing is performed in accord- 
ance with the request of the service, and the resultant 
data of the processing is replied to the client 1 through 
the processing server 2a (5). In this case, the 
resource management server 3a defines the right to 
use the resource and the above steps are performed 
based on the right to use. 

However, for example, when a crash occurs in the 
current processing server 2a, the nuclear program 4 
detects the crash and commands a transfer of the pro- 
cessing from the current processing server 2a to the 
spare processing server 2b (5'). When the spare pro- 
cessing server 2b receives the command from the 
nuclear program 4 (6'), the spare processing server 
2b again requests the service to the resource man- 
agement server 3a (7'). After this, the same steps are 
performed as explained above (8' -> 9" 10' 1 1'). 
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When the processing operation is completed in the re- 
transmission operation, the processing operation is 
replied to the processing server (1 0'). 

Further, in the above crash state, the nuclear pro- 
gram 4 sends a message of request to the current s 
resource management server 3a to withdraw the right 
to use already issued to the crashed processing ser- 
ver 2a. When the resource management server 3a 
receives this message from the nuclear program 4, 
the current resource server 3a performs an operation 10 
for purging (below, purging operation) the right to use 
from therein based on the message requested from 
the nuclear program 4. When the spare processing 
server 2b receives the command of the transfer from 
the nuclear program 4, the spare processing server 2b 15 
sends the message to the resource management ser- 
ver 3a to acquire the right to use. 

Figure 2A shows the processing operation at the 
current processing server and the resource manage- 
ment server, and Figure 2B shows the processing 20 
operation at the current server and the nuclear prog- 
ram. In Fig. 2A, when the current processing server 2a 
receives the message for requesting the service (step 
1), the current processing server 2a requests the ser- 
vice from the resource management server (step 2). 25 
The resource management server 3a receives the 
request of the service (step 6), examines the message 
to determine whether it is a re-transmitted message 
and records the request of the message (step 7). 
When the message is are-transmission (YES, in step 30 
8), the resource management server 3a judges the 
request of the service to determine whether it is 
already processed (step 9). When the request of the 
service is already processed (YES, in step 9), the 
result of processing is replied to the processing server 35 
2a (step 1 1). When the message is not a re-transmit- 
ted message (NO, in step 8), the resource manage- 
ment server performs the request of the service (step 
10) and the result of the processing is replied to the 
processing server 2a (step 11). 40 

Further, the current processing server detects 
whether the resource management server 3a is 
crushed (step 3), when it is crashed, the message is 
re-transmitted from the processing server to the 
resource management server 3a (step 4). When the 45 
resource management server Is not crashed (NO, in 
step 3), the request of the service is imparted to the 
client 1. 

In Fig. 2B, when the current processing server 2a 
has the processing in pending (YES, in step 2), the so 
request of the service is re-transmitted to the resource 
management server 3a (step 3). Then, the processing 
server detects whether the resource management 
server is crashed (step 4), the message is re-transmit- 
ted from the processing server to the resource server 55 
when it is crashed (step 5). When the resource man- 
agement server is not crashed, the request of the ser- 
vice is replied to the client (step 6). Further, the 



nuclear program 4 detects whether or not the current 
processing server is crashed (step 7), the nuclear pro- 
gram 4 commands the transfer of the processing to 
the spare processing server 2b when the current pro- 
cessing server 2a is crashed (step 8). 

Figure 3 is a view for explaining an issue proces- 
sing of the right to use. As shown in the drawing, the 
client 1 sends the message for requesting the service 
to the current processing server 2a (1). When the cur- 
rent processing server 2a receives the message for 
requesting the service from the client 1, the current 
processing server 2a sends the message for request- 
ing the issue of the right to use to the current resource 
management server 3a (2). The current resource 
management server 3a examines the message to 
determine whether it is the re-transmission message, 
and takes the record of the message of the request 
(3). The current resource management server 3a regi- 
sters the right to use in accordance with the request 
from the processing server 2a (4), and performs the 
processing to be issued. The registration of the right 
to use is imparted to the current processing server (6), 
and that processing is replied from the current proces- 
sing server 2a to the client 1 (7). 

When the crash occurs in the current processing 
server 2a, the nuclear program 4 detects the crash 
and requests the purging (the purging request) of the 
right to use already issued to the current resource 
management server 3a. When the current resource 
management server 3a receives the purging request, 
the current resource management server 3a purges 
the corresponding right to use therefrom 

There are, however, some problems in the above 
conventional art as explained in detail below. In the 
fault-tolerant processing system based on the mes- 
sage re-transmission, assuming thatthe-crash occurs 
in the current processing server 2a, the current 
resource management server 3a simultaneously 
receives two requests, i.e., the purging requestforthe 
right to use from the nuclear program 4 and the mes- 
sage of re-transmission for requesting the issue of the 
right to use from the spare processing server 2a 
Accordingly, problems occur with the simultaneous 
reception of two requests as explained in detail 
hereinafter. 

Figures 4 to 7 are views for explaining the prob- 
lems in a conventional art 

In Fig. 4, when the crash occurs in the current pro- 
cessing sever 2a (4'), the nuclear program 4 
immediately informs the purging request of the rightto 
use to the current resource management server 3a 
and detects the corresponding right to use (7, 8) so 
that the resource management server 3a immediately 
cancels the corresponding right to use (9). This is 
because this right to use corresponds to the first 
request of service from the current processing server 
2a, and the corresponding right to use must be can- 
celled in the current resource management server 3a 
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since the current processing server 2a is crashed. 

As shown in the drawing, when the spare proces- 
sing server 2b transfers the request (6), it re-transmits 
the message to the resource management server 3a 
(7'). In this case, since the right to use is already can- 5 
celled before the current resource management ser- 
ver 3a receives the re-transmission of the message 
from the spare processing server 2b, problems do not 
occur if these steps occur normally. The new right to 
use of the re-transmission is registered in the current 10 
resource management server 3a (9'), and after regis- 
tration of the new right to use, the result of the proces- 
sing is imparted to the spare processing server 2b 
(11'). 

In Fig. 5, as shown in steps 6, 7, and 8', when the 15 
crash occurs in the current processing server 2a (4')» 
the purging request of the right to use from the nuclear 
program 4 is informed (7) after the current resource 
management server 3a receives the re-transmission 
of the message from the spare processing server 2a 20 
(8'). Now, a problem occurs in these steps as exp- 
lained below. That is, at that time, the previous right 
to use is not cancelled from the current resource man- 
agement server 3a. Further, the new right to use can 
not yet be registered in the current resource manage* 25 
ment server 3a although the current processing ser- 
ver Is already crashed. Accordingly, the current 
resource management server 3a can not issue a new 
right to use for the spare processing server 2b. 

In Fig. 6, as to the steps explained in Fig. 5, when 30 
the purging request is belatedly transmitted to the 
resource management server 3a (8), the new right to 
use is cancelled based on this purging request (9). 
That is, if the previous right to use is used for the re- 
transmission of the message from the spare proces- 35 
sing server 2a, this right to use is cancelled by means 
of the purging request belatedly informed from the 
nuclear program 4 (9). 

In Fig. 7, when the purging request is belatedly 
informed from the nuclear program 4 to the resource 40 
management server 3a (13), this purging request for 
the right to use can not be cancelled because it is 
unclear as to whether it Is caused by the crash of the 
current processing server or it is caused by the client 
(14). Accordingly, for the spare processing server 2b 45 
which received the processing operation from the cur- 
rent processing server, the current resource manage- 
ment server 3a can not use the previous right to use 
since it is not cancelled. 

From the above reasons, in the processing ser- so 
vers 2a, 2b and the resource management servers 3a, 
3b which are provided as a global service program, it 
is difficult to simply utilize these servers as the fault- 
tolerant method based on the re-transmission of the 
message. as 

Accordingly, the primary object of the present 
invention lies in the rapid re-issue of the right to use, 
for the resource management server when the crash 



occurs in the current processing server. 

Figure 8 is basic block diagram of an issue pro- 
cessing system according to one aspect of the pre- 
sent invention. The same reference numbers used in 
Fig. 1 are attached to the components in this drawing. 
As explained above, the client 1 sends a message for 
requesting a service to the processing server. The 
processing server 2a is provided as a current server. 
The current processing server 2a requests the service 
to the resource management server, and imparts the 
resulting processing, which is performed in the 
resource management server, to the client 1 . The pro- 
cessing server 2b is provided as a spare processing 
server. When the crash occurs in the current proces- 
sing server 2a , the processing operation is transferred 
from the current processing server 2a to the spare 
processing sever 2b. 

The resource management server 3a is provided 
as a current management server. The resource man- 
agement server 3a acquires the right to use from the 
nuclear program 4 in accordance with the request of 
the service and issues a corresponding right to use to 
the current processing server 2a. The resource man- 
agement server 3b Is provided a space management 
server. The resource management server 3a has a re- 
transmission detection means 30, a registration issue 
means 31, a discriminator addition means 32, and a 
right to use examination means 33. These means are 
explained in detail below. The nuclear program 4 is 
provided for checking the operation of the processing 
servers and for managing (for example, registering, 
cancelling, checking, etc.) the right to use. Accord- 
ingly, the nuclear program 4 has management means 
40 for the right to use the resource. 

The re-transmission detection means 30 
examines the message to determine whether it is a re- 
transmitted message in accordance with a discrimi- 
nator attached to the massage. In this case, the 
message is transmitted from the current processing 
server 2a and includes the request for acquiring the 
resource. The registration issue means 31 acquires 
the right to use in response to the message, registers 
the acquired right to use in the management means 
40, and issues the right to use to the current proces- 
sing server 2a. Further, the registration issue means 
31 cancels the registered right to use in accordance 
with the Information from the processing server 2a 
and the nuclear program 4. The discriminator addition 
means 32 attaches the discriminator of the message 
to the right to use when the registration issue means 
31 registers the right to use into the management 
means 40. The right to use examination means 33 
examines the right to use to determine whether it is 
already issued and registered in accordance with the 
message of the re-transmission. This examination is 
performed with reference to the discriminator in the 
management means 40 at the time when the re- 
transmission detection means 30 detects that the 
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message is a re-transmitted one. 

Figure 9 is a view for explaining the processing 
steps of the structure shown in Fig. 8. As explained 
above, when the resource management server 3a 
judges that the message of the request for acquiring 
the resource from the current processing server 2a is 
not the re-transmitted message in accordance with 
the processing at the re-transmission detection 
means 30, the resource management server 3a 
acquires the requested right to use. The resource 
management server 3a registers the acquired right to 
use into the right to use management means 40, and 
issues that acquired right to use to the current proces- 
sing server 2a. Further, the resource management 
server 3a adds the discriminator corresponding to the 
issued message to the right to use to be registered. 

When the resource management server 3a 
judges that the message of the request is the re- 
transmitted message in accordance with the proces- 
sing at the re-transmission detection means 30, the 
resource management server 3a judges whether the 
corresponding right to use is registered and issued in 
accordance with the processing at the right to use 
examination means 33. When the right to use is 
already registered and issued, the resource manage- 
ment server 3a ignores the previous right to use in 
accordance with the processing at the registration 
issue means 31 , and registers a new right to use after 
addition of the discriminator, then issues a new right 
to use to the spare processing server 2b. 

In this case, when the right to use is not yet regis- 
tered and issued, there are two causes in the 
crash,l.e. t the crash at the resource management ser- 
ver itself or the crash at the current processing server 
itself. Accordingly, the resource management server 
3a again registers the right to use after the addition of 
the discriminator and issues a new right to use to the 
spare processing server 2b. 

As shown in Fig. 9, in the resource management 
server 3a, when the right to use is registered (4), the 
ID is added to the right to use (5), and, after the addi- 
tion of the ID, the right to use is registered into the nuc- 
lear program 4 (6). The issue of the right to use and 
the result of the processing are imparted to the current 
processing server (7). When the crash occurs in the 
current processing server (4'), the processing oper- 
ations transferred to the spare processing server (6 r ) 
and re-transmlts the request to the resource manage- 
ment server (7'). When the resource management 
server 3a receives the re-transmission of message 
(8'), it examines the message and determines 
whether it is a re-transmitted message (9'). When the 
message is retransmitted, the previously registered 
message is ignored (10') and a new right to use Is 
registered (12'). Then the ID is added to the new right 
to use (13') and this right to use is registered into the 
nuclear program 4 (1 4'). 

Figure 10 is a schematic block diagram of an 



issue processing system according to an embodiment 
of the present invention. In Fig. 10, reference num- 
bers 5a and 5b denote file name servers, and 6a and 
6b denote file management servers. In this case, 5a 

5 and 6a are used as current systems, and 5b and 6b 
are used as spare systems. The file name server 5a 
has a file name management means 50. The file man- 
agement server 6a has a file access management- 
means 60, a re-transmission message examination 

10 means 61 , a file right to use registration/issue means 
62, an ID addition means 63, a processing exami- 
nation means 64, and a file right to use invalidation 
means 65. 

The client 1 issues the request for opening a file 

15 (below, file opening request) to the file name server 
5a. The file name server 5a defines one of file man- 
agement servers 6a and issues a file opening request 
to the defined file management server 6a. Accord- 
ingly, the file name management means 50 is pro- 

20 vided for managing the relationship between the file 
name and its location. 

In the file management server 6a, the file access 
management means 60 is provided for performing an 
access processing to the file. The re-transmission 

25 message detection means 61 is provided forjudging 
whether the message of the file opening request Is a 
re-transmitted message based on the discriminator 
attached to the message. The ffle right to use regis- 
tration/issue means 62 is provided for performing the 

so registration, the Issue, and the cancellation of the right 
to use. The ID addition means 63 is provided for 
adding the discriminator to the message of the rightto 
use of the file when the right to use of the file is regis- 
tered. The processing examination means 64 ts pro- 

35 vided forjudging whether the right to use file is issued 
and registered. The file right to use invalidity means 
65 is provided for making the right to use of the file 
invalid. 

Figure 11 is one example of a discriminator 
40 according to the present invention. A multi-request ID 
is used tor requesting the opening of the file. A 
request counter is used for displaying the request 
number at the multi-request ID. A re-transmission 
counter is used for counting the number of the re- 
45 transmission of the same file opening request 
Accordingly, the re-transmission message detection 
means 61 detects the re-transmission message when 
the number of the re-transmission counter is Indis- 
criminate. 

so Figure 12A to 14B are flowcharts for explaining 

the processing of the present invention. Figures 12A 
and 12B are flowcharts for explaining the processing 
in the file name server, Figures 13A and 13B are flow- 
charts for explaining the processing in the nuclear 

65 program, and Figures 1 4A and 14B are flowcharts for 
explaining the processing In the file management ser- 
ver. 

In Fig. 12A, the current file name server 5a 

7 
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receives the message of the file opening request from 
the client (step 1), refers to theflle name management 
means 50 therein, acquires the file management ser- 
ver 6a managing the corresponding file with which the 
file opening request exists (step 2), and sends the s 
message of the file opening request to the corre- 
sponding file management server Sa (step 3). Next, 
when the corresponding file management server 6a . . 
crashes (YES, in step 4), the message of the file open- 
ing request is re-transmitted from the file name server 10 
5a (step 5). When the corresponding file management 
server 6a does not crash (NO!, in step 4), the proces- 
sing at the file management server 6a is replied to the 
file name server 5a after registration of the file right to 
use in the file management server 6a (step 6). 15 

In Fig. 12B, the spare file name server 5b 
receives the command of the transfer of the proces- 
sing from the nuclear program 4 (step 1), detects the 
processing in hand therein (step 2), when the proces- 
sing in hand exists therein (YES, step 2), the message 20 
of the file opening request is re-transmitted from the 
spare file name server 5b to the corresponding file 
management server 6a (step 3). Next, when the cor- 
responding file management server 6a crashes (step 
4, YES), the message of the fife opening request is re- 25 
transmitted from the spare fife name server 5b (step 
5). When the corresponding file management server 
6a does not crash (step 4, NO), the processing at the 
fife management server 6a is replied to the spare file . 
name server 5b after registration of the file right to use 30 
in the file management server 6a (step 6). 

In Fig. 13 A, the nuclear program 4 always checks 
whether the operation of the current file name server 
5a is crashed (step 1 ). When the currentfile name ser- 
ver 5a crashes (YES, step 1 ), the nuclear program 4 35 
commands the transfer of the processing to the spare 
file name server 5b. 

In Fig. 13B, the nuclear program 4 checks 
whetherthe right to use at the file management server 
6a should be purged (step 1). When the crashed cur- 40 
rent file name server 5a has the right to use, the nuc- 
lear program 4 sends the purging request to the file 
management sever 6a so as to purge the correspond- 
ing right to use (step 2). 

In Fig. 14A, when the file management server 6a 45 
receives the purging request of the file right to use 
from the nuclear program 4, the file management ser- 
ver 6a judges whether the corresponding file right to 
use is valid (step 1). When the corresponding file right 
to use is yet valid (YES, step 1), it is cancelled from so 
the file management server 6a based on the com- 
mand of the nuclear program 4 (step 2). 

In Rg. 14B, when the file management server 6a 
receives the message of the file opening request from 
the file name server 5a (step 1), the file management 55 
server 6a checks the value of the re-transmission 
counter of the discriminator attached to the message, 
examines whether the message is re-transmitted 



message, and records the result of the examination to 
transferee processing to the spare file management 
server 6b (step 2). Next, based on the result of the 
examination, when the message is not re-transmitted 
one (NO, in step 3), the file management server 6a 
attaches the discriminator to the corresponding file 
right to use and registers the file right to use into a 
memory area of the nuclear program 4 (step 4). In this 
case, the file right to use is registered with the dis- 
criminator. After above steps, the registered file right 
to use is transmitted to the file name server 5a to 
which the fife opening request is issued (step 5). 

When the message is a re-transmission (YES, in 
step 3), the fife management server 6a examines 
whether the file right to use is already registered in 
accordance with the previous message of the file 
opening request (step 6). When the file right to use is 
not registered therein (NO, in step 7), the addition of 
the ID and registration of the right to use are perfor- 
med (step 4). When the file right to use is already 
registered therein (YES, step 7), the corresponding 
file right to use is cancelled (step 8), and the addition 
of the ID and registration of the right to use are per- 
formed (step 4). 

Figure 15 is a view for explaining the processing 
operation in the system shown in Fig. 10. Each step 
of this drawing is already explained in the previous 
drawings. Accordingly, the detailed explanations are 
omitted in this stage. Briefly, the file management ser- 
ver according to the present invention can rapidly 
issue the file right to use to the spare file name server 
5b even if the file management server 6a receives the 
request of the file right to use from the spare file name 
server 5b before the reception of the purging request 
from the nuclear program 4. 

Figure 16 is a schematic block diagram of a data 
processing system having a global service program 
based on a fault-tolerant method. In Fig. 16, AP 
denotes a application program, GS2 denotes a global 
service program used as a current system, GS3 
denotes a global service program used as a spare 
system, GS4 denotes a file global service program, 
FL denotes a file provided in an external storage 
device. 

As explained above, in a data processing system, 
a global service program is provided for controlling all 
resources in the system, and a predetermined service 
is provided to an application program with reference 
to filed information in accordance with processing of 
the global service program. In general, the global ser- 
vice program has a current system and a spare sys- 
tem to perform a fault-tolerant method. According to 
this fault-tolerant method, the application program 
does not detect the crash of the global service prog- 
ram. In this fault-tolerant method, ft is necessary for 
the spare global service program to rapidly open the 
file when the crash occurs in the current global prog- 
ram. 
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A3 shown in the drawing, in a normal processing 
operation, when the predetermined processing is 
requested from the application program AP to the 
global service program, the current GS2 transmits a 
file opening request to the fie GS4. The file GS4 per- 
forms a file opening processing so that the file FL is 
opened by the file GS4. Accordingly, the current GS2 
can process the requestfrom the application program. 

When the crash occurs in the current GS2, the 
processing request from the application program is 
transferred from the current GS2 to the spare GS3, 
and the spare GS3 transmits the file opening request 
to the file GS3 so that the spare GS3 can process the 
request from the application program. Accordingly, 
the application program does not detect the crash of 
the global service program. 

Figure 17 is a view for explaining processing 
operation when the crash occurs in the current GS2. 
When the crash of the current GS2 is detected by a 
supervisor (in this case f a supervisor corresponds to 
the nuclear program 4 in Fig. 8), the processing 
request is transferred from the current GS2 to the 
spare GS3 and the file is opened by the file GS4. In 
the normal crash processing operation, the supervisor 
transmits the message of request for withdrawing the 
file opening environment to the file GS4, and the file 
GS4 performs the withdrawal of the file opening envi- 
ronment as to the current GS2 based on the message 
from the supervisor. In general, the withdrawing oper- 
ation of the file opening environment in the fife GS4 is 
simultaneously performed with the file opening 
request in the spare GS3. Accordingly, when the file 
opening request is issued from the spare GS3 to the 
file GS4 before the withdrawing operation is com- 
pleted in the file GS4, the competition of the request 
occurs in the file FL so that the file GS4 outputs an 
"open error" to the spare GS3. 

Figure 18 is a schematic block diagram of an 
issue processing system according to another aspect 
of the present invention. In Fig. 18, reference number 
10 denotes a data processing means, 20 a file, 30a a 
current service producing means, 30b a spare service 
producing means, 40a a current access processing 
means, 40b a spare access processing means, and 
50 a discriminator allocating means. 

The file 20 manages data necessary for the data 
processing operation in the data processing means 
10. The current service producing means 30a is star- 
ted in response to the request of the service from the 
data processing means 10, and produces the pre- 
determined service to the data processing means 10. 
In general, a plurality of service producing means 30a 
are provided in the system. The spare service produc- 
ing means 30b is provided for transferring the proces- 
sing from the current service producing means 30a 
when the crash occurs in the current service produc- 
ing means 30a. The access processing means 40a is 
started in response to the request of the opening of 



the file from the current/spare service producing 
means 30a and 30b, and performs the service of the 
resource management in the file 20. The discriminator 
allocating means 50 uniformly allocates the discrimi- 

5 nator to each current service producing means 30a, 
and also allocates the discriminator to the corre- 
sponding spare service producing means 30b. 

As shown in the drawing, the service producing 
means 30a has an opening request issuing means 

10 31a and a discriminator informing means 32a. The 
opening request issuing means 31a issues the open- 
ing request of the file 20 to the access processing 
means 40a. The discriminator informing means 32a 
informs the discriminator allocated by the discrimi- 

15 nator allocating means 50 to the access processing 
means 40a when the opening request is issued from 
the opening request issuing means 31a. 

The access processing means 40a has an open- 
ing request receiving means 41a, an opening proces- 

20 sing means 42a, a discriminator managing means 
43a, and an opening environment withdrawal means 
44a. The opening request receiving means 41a 
receives the file opening request issued from the 
opening request issuing means 31 a. The opening pro- 

25 cessing means 42a performs the opening processing 
to the file 20. The discriminator managing means 43a 
manages the discriminator, which is informed from the 
discriminator informing means 32a, until the with- 
drawal of the file opening environment is completed. 

30 The opening environment withdrawing means 44a 
withdraws the file opening environment already pro- 
vided. 

In the present invention, the discriminator inform- 
ing means 32a informs the discriminator allocated by 

35 the discriminator allocating means 50 to the access 
processing means 40a when the opening request 
Issuing means 31a issues the file opening request to 
the access processing means 40a. When the opening 
request receiving means 41 a receives the file opening 

40 request and the discriminator from the opening 
request issuing means 31a, the opening request 
receiving means 41a starts the opening processing 
means 42a and registers the discriminator into the 
discriminator managing means 43a. The opening pro- 

45 cessing means 42a sets the file opening environment 
therein, issues an I/O command to the file 20, and ref- 
ers to the content of the file 20. 

The discriminator managing means 43a man- 
ages the discriminator until the processing at the 

so opening processing means 42a is finished and the 
withdrawal of the file opening environment is com- 
pleted. In the above steps, when the crash is detected 
in the current service producing means 30a, the pro- 
cessing is transferred from the current service pro- 

55 ducing means 30a to the spare service producing 
means 30b. In the above transfer operation, when the 
opening request issuing means 31b must issue the 
file opening request to the access processing means 
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40a, the discriminator informing means 32b informs 
the discriminator allocated by the discriminator 
allocating means 50 to the access processing means 
40a. 

When the opening request receiving means 41a 5 
receives the file opening request from the spare ser- 
vice producing means 30b, the opening request 
receiving means 41 a searches the discriminator man- 
aging means 43a so as to determine whether or not 
the same discriminator as informed from the spare 10 
service producing means 30b is provided therein. 

When the opening request receiving means 41a 
detects that the same discriminator is not managed in 
the discriminator managing means 43a, the opening 
request receiving means 41a starts the opening pro- is 
cessing means 42a so as to perform the file opening 
requestfrom the spare service producing means 30b. 
When the opening request receiving means 41a 
detects that the same discriminator is managed in the 
discriminator managing means 43a, the opening 20 
request receiving means 41a judges whether the with- 
drawal command of the file opening environment, 
which is transmitted from a supervisor, is input yet 
from the supervisor. In this case, the opening request 
receiving means 41a immediately starts the opening 25 
environment withdrawing means 44a to forcibly with- 
draw the file opening environment from the opening 
environment withdrawing means 44a. 

As explained above, in the present invention, 
when the spare service producing means 30b issues 30 
the tie opening request to the access processing 
means 40a, the access processing means 40a judges 
whether or not the file opening environment, which is 
already set in the discriminator managing means 43a 
in response to the tUe opening request from the spare 35 
service producing means 30a, is withdrawn. When the 
file opening environment is not yet withdrawn, the 
withdrawal is forcibly performed in the opening envi- 
ronment withdrawing means 44a so that it is possible 
to prevent an opening error in the data processing 40 
system. 

Figure 1 9 is a schematic block diagram according 
to one embodiment of the second aspect of the pre- 
sent invention shown in Fig. 18. In Fig. 19, the same 
reference letters as used in Fig. 16 are attached to the 45 
same components in this drawing. GS1 denotes a dis- 
criminator, CT denotes a control table, and GSP 
denotes a global service program for managing a 
start-up of the global service program. The control 
table CTfor storing discriminators is provided in mem- so 
ory area in the file GS4 to manage the file opening 
environment 

The GSP is provided for sorting the current GS2 
and the spare GS3. Further, the GSP allocates the 
discriminator to the current GS2 when starting the cur- ss 
rent GS2, and also allocates the same discriminator 
as that of the current GS2 to the spare GS3 when 
starting the spare GS3. Accordingly, the discriminator 



GS1 is allocated to the current GS2, and also allo- 
cated to the spare GS3. The current GS2 and the 
spare GS3 inform the allocated discriminator to the 
file GS4 when issuing the file opening request to the 
ffleGS4. 

Figure 20 is a flowchart for explaining the proces- 
sing operation in the file GS4. In Fig. 20, first, the file 
GS4 receives the file opening request and the dis- 
criminator (step 1). Next, the file GS4 judges whether 
the same discriminator as received above is already 
set in the control table CT (step 2). 

When the same discriminator is set in the control 
table CT (YES)(i.e., when the file opening request at 
the step 1 indicates the requestfrom the spare GS3), 
the fBe GS4 forcibly withdraws the file opening envi- 
ronment and the I/O command (step 3). 

When the same discriminator is not set in the con- 
trol table CT (NO) (i.e., when the file opening request 
at the step 1 indicates the request from the current 
GS2, or when the file opening request indicates the 
requestfrom the spare GS3 after the opening environ- 
ment of the current GS2 is already withdrawed), the 
file GS4 performs the opening process (step 4). The 
file GS4 sets the received discriminator In the control 
table (step 5). Accordingly, when the crash does not 
occur in the current GS2 f the discriminator of the cur- 
rent GS2 in the control table CT is held until the 
access processing to the file is completed. 

Figure 21 is a view for explaining the processing 
operation according to the present invention. As 
shown in the drawing, when the file opening request 
is issued from the spare GS3, the file GS4 forcibly 
withdraws the file opening environment which is set in 
response to the file opening requestfrom the current 
GS2. Accordingly, tt is not necessary to output the 
open error from the file GS4 to the spare GS3. 



Claims 

1. An issue processing system for a right to use a 
resource in a data processing system having a 
global service program based on a fault-tolerant 
method which provides a current processing ser- 
ver (2a) and a spare processing server (2b), each 
processing server (2a, 2b) performing a predeter- 
mined data processing requested from a client (1) 
based on a resource acquired by a current 
resource management server (3a), and the pre- 
determined data processing being transferred 
from the current processing server (2a) to the 
spare processing server (2b) based on a com- 
mand of a transfer from a nuclear program (4) 
when a crash occurs in the current processing 
server (2a), the resource management server 
(3a) comprises: 

re-transmission examination means (30) 
for examining a message from the processing 
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server and determining whether or not it is a re- 
transmitted message based on a discriminator 
attached to the message for requesting acquire- 
ment of the right to use the resource; 

discriminator addition means (32) for s 
adding the discriminator to the message for 
requesting the right to use to be issued when that 
right to use is registered; 
and . . _ 

right to use examination means (33) for 10 
examining whether the message is already regis- 
tered based on a previous message for the re- 
transmission by referring to the discriminator 
attached by the discriminator addition means (32) 
when the message indicates the re-transmission 15 
message based on the detection of the re- 
transmission examination means (30); 

wherein, when the examination means 
(33) judges that the right to use is already regis- 
tered, the above registered right to use is invaii- 20 
dated, and a new right to use is registered into the 
nuclear program (4) and the new right to use is 
issued to the processing server (2a, 2b). 

2. An issue processing system as claimed in claim zs 
1 , wherein the discriminator transmitted from the 
processing server (2) to the resource manage- 
ment server (3) Is discriminated in accordance 
with an one-to-one discriminator and a re- 
transmission number discriminator for counting 30 
the number of the re-transmission, and the re- 
transmission examination means (30) judges 
whether the message is the re-transmitted mes- 
sage based on the re-transmission count dis- 
criminator. 35 



occurs in the current service producing means, 
the system comprising: 

a discriminator allocating means (50) for 
allocating the same discriminator to the current 
and spare service producing means; and 

a discriminator informing means (32a, 
32b) for informing the discriminator allocated by 
the discriminator -allocating means (50) to the 
access processing means (6a) for processing a 
file access when the service producing means 
issues the file opening request, 

wherein the access processing means 
manages the discriminator until the withdiawai of 
the opening environment is completed, the dis- 
criminator being informed from the current ser- 
vice producing means at the time of the file 
opening request therefrom, further, when the 
access processing means manages the same 
discriminator as that of at the time of the file open- 
ing request based on the spare service producing 
means, the opening environment defined by the 
discriminator is forcibly withdrawn; 

5. An issue processing method as claimed in claim 
4, wherein the discriminator allocating means 
(50) allocates the same discriminator to both ser- 
vice producing means when the current and 
spare service producing means (30a, 30b) are 
started. 



3. An issue processing system as claimed in claim 
1, wherein the ont-to-one discriminator is 
uniformly constituted by a multi-discriminator and 

an issue number counting discriminator, the mul- 40 
ti-discriminator being used for the request of 
acquirement to the same resource, and the issue 
number counting discriminator indicating the 
number of issues of the multi-discriminator. 

45 

4. An issue processing system for a right to use a 
resource in a data processing system having a 
global service program based on a fault-tolerant 
method providing a current service producing 
means (30a) and a spare service producing so 
means (30b), each service producing means per- 
forming a predetermined data processing reques- 
ted from a data processing means (1 0) based on 

an access processing means (40a), and the pre- 
determined data processing being transferred ss 
from the current service producing means to the 
spare service producing means based on a com- 
mand of transfer from a supervisor when a crash 
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Description 

BACKGROUND OF THE INVENTION 

1. Field of the Invention 

The present invention relates to an issue process- 
ing system for a right to use a resource in a data 
processing system having a global service program 
based on a fault-tolerant method. More particularly, it re- 
lates to a system for rapidly processing an issue oper- 
ation of a right 1o use a resource from a spare processing 
server to a resource management server in a data 
processing system employing a fault-tolerant method. 

2. Description of the Related Art 

In a data processing system, a global service pro- 
gram is provided for controlling all resources in the sys- 
tem, and a predetermined service is provided to an ap- 
plication program with reference to filed information in 
accordance with a processing of the global service pro- 
gram. In general, the global service program has a cur- 
rent system and a spare system to employ a fault-toler- 
ant method. According to this fault-tolerant method, the 
application program does not detect the crash of the glo- 
bal service program. In this fault-tolerant method, it is 
necessary for the spare global service program to rap- 
idly open the file when the crash occurs in the current 
global program. 

That is, in the fault-tolerant method, there are pro- 
vided a current processing server and a spare process- 
ing server in the system to take a countermeasure for 
an accident (for example, crash of a software in the cur- 
rent server) so that it is possible to continuously offer 
the service to the client. For example, when the accident 
occurs in the current processing server, the processing 
operations are rapidly transferred from the current 
processing server to the spare processing server. 

There are, however, some problems in the system 
employing the global service program, as explained in 
the following. 

The article by A. Borg : et al. entitled "Fault Toler- 
ance under UNIX" of ACM Transactions on computer 
systems, vol. 7, No t , February 1 989 at pages 1 to 24, 
discloses a system using message-based communica- 
tion and inactive backup processes to ensure that proc- 
esses survive hardware failures. 

This article discloses an issue processing system 
for a right to use a resource in a data processing system 
having a global service program based on a fault-toler- 
ant method which provides a current processing server 
and a spare processing server, each processing server 
performing predetermined data processing requested 
from a client based on a resource acquired by a current 
resource management server, and the predetermined 
data processing being transferred from the current 
processing server to the spare processing server based 



on a command of a transfer from a nuclear program 
when a crash occurs in the current processing server. 

According to the invention, the resource arrange- 
ment comprises: re-transmission examination means 
s for examining a message from the processing server 
and determining whether or not it is a re-transmitted 
message based on a discriminator attached to the mes- 
sage for requesting acquirement of the right to use the 
resource; discriminator addition means for adding the 
70 discriminator to the message for requesting issuance of 
the right to use when that right to use is registered; and 
right to use examination means for examining whether 
the right to use is already registered based on a previous 
message by referring to the discriminator attached by 
the discriminator addition means, when the message is 
indicated as the re-transmission message based on the 
detection of the re -transmission examination means; 
wherein, when the examination means judges that the 
right to use is already registered, the above registered 
right to use is invalidated, and a new right to use is reg- 
istered into the nuclear program and the new right to use 
is issued to the spare processing server. 

Preferably, the discriminator transmitted from the 
processing server to the resource management server 
comprises a unique discriminator and a re-transmission 
number discriminator for counting the number of the re- 
transmission, and the re-transmission examination 
means judges whether the message is the re-transmit- 
ted message based on the re-transmission count dis- 
criminator. 

The unique discriminator may then comprise a mul- 
ti-request discriminator and an issue number counting 
discriminator, the multi-request discriminator being 
used for the request of acquirement to the same re- 
source, and the issue number counting discriminator in- 
dicating the number of issues of the multi-request dis- 
criminator. 

The article described above also discloses an issue 
processing system for a right to use a resource in a data 
processing system having a global service program 
based on a fault-tolerant method providing a current 
service producing means and a spare service producing 
means, each service producing means performing a 
predetermined data processing requested from a data 
processing means based on an access processing 
means, and the predetermined data processing being 
transferred from the current service producing means to 
the spare service producing means based on a com- 
mand of transfer Irom a supervisor when a crash occurs 
in the current service producing means. 

According to a second realization of the invention, 
the system comprises : a discriminator allocating means 
for allocating the same discriminator to the current and 
spare service producing means; and a discriminator in- 
forming means of the current and of the spare service 
producing means for informing the access processing 
means of the discriminator allocated by the discrimina- 
tor allocating means, for processing a file access when 
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the service producing means issues a file opening re- 
quest, wherein the access processing means manages 
the discriminator until the withdrawal of the opening en- 
vironment is completed, the access processing means 
being informed of the discriminator from the current s 
service producing means at the time of the file opening 
request therefrom, further, when the access processing 
means manages the same discriminator from the spare 
service producing means as that from the current serv- 
ice proce_ssing means, at the time of the file opening re- io 
quest, the opening environment defined by the discrim- 
inator is forcibly withdrawn. 

In a preferred embodiment, the discriminator allo- 
cating means allocates the same discriminator to both 
service producing means when the current and spare ^$ 
service producing means are started. 

BRIEF DESCRIPTION OF THE DRAWINGS 

In the drawings: 20 

Fig. 1 is a view explaining a fault-tolerant method 
by using message re-transmission in a convention- 
al art; 

Fig. 2A and 2B are flowcharts for explaining the op- 25 
eration of the structure shown in Fig. 1; 
Fig. 3 is a view explaining an issue processing of a 
right to use; 

Figs. 4 to 7 are views explaining problems in a con- 
ventional art; 30 
Fig. 8 is a basic block diagram of an issue process- 
ing system according to one aspect of the present 
invention; 

Fig. 9 is a view for explaining processing steps of 
the structure shown in Fig. 8; 3S 
Fig. 10 is a schematic block diagram of an issue 
processing system according to an embodiment of 
the present invention; 

Fig. 11 is one example of a discriminator according 
to the present invention; 40 
Figs. 1 2A and 1 2B are flowcharts for explaining the 
processing in a file name server; 
Figs. 1 3A and 1 3B are flowcharts for explaining the 
processing in a nuclear program; 
Figs. 1 4A and 1 4B are flowcharts for explaining the 4$ 
processing in a file management server; 
Fig. 15 is a view for explaining the processing op- 
eration in the system shown in Fig. 10; 
Fig. 16 is a schematic block diagram ol a data 
processing system having a global service program so 
based on a fault-tolerance method; 
Fig. 17 is a view explaining the processing opera- 
tion when a crash occurs in the current global serv- 
ice program GS2; 

Fig. 18 is a schematic block diagram of an issue ss 
processing system according to another aspect of 
the present invention; 

Fig. 19 is a schematic block diagram according to 



one embodiment of the second aspect of the 
present invention shown in Fig. 18; 
Fig. 20 is a flowchart for explaining the processing 
operation in the file of the global service program 
GS4; and 

Fig. 21 is a view for explaining the processing op- 
eration according to the present invention. 

DESCRIPTION OF THE PREFERRED 
EMBODIMENTS ~ ------ 

Before describing the preferred embodiments, a ex- 
planation is given of a conventional art and its problem. 

Figure 1 is a view for explaining a fault-tolerant 
method by using message re-transmission, and Figures 
2A and 2B are flowcharts for explaining the operation of 
the structure shown in Fig. 1. 

In Fig. 1 , reference number 1 denotes a client, 2a a 
current processing server, 2b a spare processing server, 
3a a current resource management server, 3b a spare 
resource management server, and 4a nuclear program. 
In this system, the spare processing server 2b and the 
spare resource management server 3b are used when 
the accident (for example, crash of a program) occurs 
in the current system. In general, the client is provided 
with a means for requesting a predetermined service of 
the resource management server to utilize the resource, 
and, in general, the client is constituted by an application 
program. The resource management server manages 
the resource in order to provide the service. In this case, 
the processing server and the resource management 
server are provided by the global service program. 

In a normal processing, when a message for re- 
questing a service is generated from the client 1 (1 ), the 
processing server 2a receives the message and re- 
quests the service from the resource management serv- 
er 3a (2). The resource management server 3a receives 
the request of the service, and examines the message 
to determine if it is re-transmitted message (3). Further, 
in a resource management server 3a, the predeter- 
mined processing is performed in accordance with the 
request of the service, and the resultant data of the 
processing is replied to the client 1 through the process- 
ing server 2a (5). In this case, the resource management 
server 3a defines the right to use the resource and the 
above steps are performed based on the right to use. 

However, for example, when a crash occurs in the 
current processing server 2a, the nuclear program 4 de- 
tects the crash and commands a transfer of the process- 
ing from the current processing server 2a to the spare 
processing server 2b (5'). When the spare processing 
server 2b receives the command from the nuclear pro- 
gram 4 (6') ( the spare processing server 2b again re- 
quests the service to the resource management server 
3a (7'). After this, the same steps are performed as ex- 
plained above (8* -> 9' -4 1 0' -» 1 1 '). When the process- 
ing operation is completed in the re-transmission oper- 
ation, the processing operation is replied to the process- 
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ing server (10'). 

Further, in Ihe above crash state, the nuclear pro- 
gram 4 sends a message ot request to the current re- 
source management server 3a to withdraw the right to 
use already issued to the crashed processing server 2a. 
When the resource management server 3a receives this 
message from the nuclear program 4, the current re- 
source management server 3a performs an operation 
for purging (below, purging operation) the right to use 
. from therein based on the message requested from the 
nuclear program 4. When the spare processing server 
2b receives the command of the transfer from the nu- 
clear program 4, the spare processing server 2b sends 
the message to the resource management server 3a to 
acquire the right to use. 

Figure 2 A shows the processing operation at the 
current processing server and the resource manage- 
ment server, and Figure 2B shows the processing oper- 
ation at the current server and the nuclear program. In 
Fig. 2A, when the current processing server 2a receives 
the message for requesting the service (step 1 ), the cur- 
rent processing server 2a requests the service from the 
resource management server (step 2). The resource 
management server 3a receives the request of the serv- 
ice (step 6), examines the message to determine wheth- 
er it is a re -transmitted message and records the request 
of the message (step 7). When the message is a re- 
transmission (YES, in step 8), the resource manage- 
ment server 3a judges the request of the service to de- 
termine whether it is already processed (step 9). When 
the request of the service is already processed (YES, in 
step 9), the result of processing is replied to the process- 
ing server 2a (step 11). When the message is not a re- 
transmitted message (NO, in step 8), the resource man- 
agement server performs the request of the service 
(step 1 0) and the result of the processing is replied to 
the processing server 2a (step 11). 

Further, the current processing server detects 
whether the resource management server 3a is crashed 
(step 3), when it is crashed, the message is re-transmit- 
ted from the processing server to the resource manage- 
ment server 3a (step 4). When the resource manage- 
ment server is not crashed (NO, in step 3), the request 
of the service is imparted to the client 1 . 

In Fig. 2B, when the current processing server 2a 
has the processing in pending (YES, in step 2), the re- 
quest of the service is re-transmitted to the resource 
management server 3a (step 3). Then, the processing 
server detects whether the resource management serv- 
er is crashed (step 4), the message is re-transmitted 
from the processing server to the resource server when 
it is crashed (step 5). When the resource management 
server is not crashed, the request of the service is re- 
plied to the client (step 6). Further, the nuclear program 
4 detects whether or not the current processing server 
is crashed (step 7), the nuclear program 4 commands 
the transfer of the processing to the spare processing 
server 2b when the current processing server 2a is 



crashed (step 8). 

Figure 3 is a view for explaining an issue processing 
of the right to use. As shown in the drawing, the client 1 
sends the message for requesting the service to the cur- 
5 rent processing server 2a (1). When the current 
processing server 2a receives the message for request- 
ing the service from the client 1 , the current processing 
server 2a sends the message for requesting the issue 
of the right to use to the current resource management 
10 server 3a (2). The current resource management server 
3a examines the message to determine whether it is the 
re-transmission message, and takes the record of the 
message of the request (3). The current resource man- 
agement server 3a registers the right to use in accord- 
75 ance with the request from the processing server 2a (4). 
and performs the processing to be issued. The registra- 
tion of the right to use is imparted to the current process- 
ing server (6), and that processing is replied from the 
current processing server 2a to the client 1 (7). 

When the crash occurs in the current processing 
server 2a, the nuclear program 4 detects the crash and 
requests the purging (the purging request) of the right 
to use already issued to the current resource manage- 
ment server 3a. When the current resource manage- 
ment server 3a receives the purging request, the current 
resource management server 3a purges the corre- 
sponding right to use therefrom. 

There are, however, some problems in the above 
conventional art as explained in detail below. In the fault- 
tolerant processing system based on the message re- 
transmission, assuming that the crash occurs in the cur- 
rent processing server 2a : the current resource man- 
agement server 3a simultaneously receives two re- 
quests, i.e., the purging request for the right to use from 
the nuclear program 4 and the message of re-transmis- 
sion for requesting the issue of the right to use from the 
spare processing server 2b. Accordingly problems oc- 
cur with the simultaneous reception of two requests as 
explained in detail hereinafter. 

Figures 4 to 7 are views for explaining the problems 
in a conventional art. 

In Fig. 4, when the crash occurs in the current 
processing server 2a (4'), the nuclear program 4 imme- 
diately informs the purging request of the right to use to 
the current resource management server 3a and de- 
tects the corresponding right to use (7, 6) so that the 
resource management server 3a immediately cancels 
the corresponding right to use (9). This is because this 
right to use corresponds to the first request of service 
from the current processing server 2a, and the corre- 
sponding right to use must be cancelled in the current 
resource management server 3a since the current 
processing server 2a is crashed. 

As shown in the drawing, when the spare process- 
ing server 2b transfers the request (6), it re-transmits 
the message to the resource management server 3a 
(7'). In this case ; since the right to use is already can- 
celled before the current resource management server 
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3a receives the re -transmission of the message from the 
spare processing server 2b, problems do not occur if 
these steps occur normally. The new right to use of the 
re-transmission is registered in the current resource 
management server 3a (9') t and after registration of the 
new right to use, the result of the processing is imparted 
to the spare processing server 2b (1 1 '). 

In Fig. 5, as shown in steps 6, 7, and 8', when the 
crash occurs in the current processing server 2a (4 1 ), 
the purging request of the right to use from the nuclear 
program 4 is informed (7) after the current resource 
management server 3a receives the re-transmission of 
the message from the spare processing server 2a (8'). 
Now, a problem occurs in these steps as explained be- 
low. That is, at that time, the previous right to use is not 
cancelled from the current resource management serv- 
er 3a. Further, the new right to use can not yet be reg- 
istered in the current resource management server 3a 
although the current processing server is already 
crashed. 

Accordingly, the current resource management server 
3a can not issue a new right to use for the spare process- 
ing server 2b. 

In Fig. 6, as for the steps explained in Fig. 5, when 
the purging request is belatedly transmitted to the re- 
source management server 3a (8), the new right to use 
is cancelled based on this purging request (9). That is, 
if the previous right to use is used for the re-transmission 
of the message from the spare processing server 2b, 
this right to use is cancelled by means of the purging 
request belatedly informed from the nuclear program 4 
(9). 

In Fig. 7, when the purging request is belatedly in- 
formed from the nuclear program 4 to the resource man- 
agement server 3a (1 3), this purging request for the right 
to use can not be cancelled because it is unclear as to 
whether it is caused by the crash of the current process- 
ing server or it is caused by the client (14). Accordingly, 
for the spare processing server 2b which received the 
processing operation from the current processing serv- 
er, the current resource management server 3a can not 
use the previous right to use since it is not cancelled. 

From the above reasons, in the processing servers 
2a, 2b and the resource management servers 3a, 3b 
which are provided as a global service program, it is dif- 
ficult to simply utilize these servers as the fault-tolerant 
method based on the re-transmission of the message. 

Accordingly, the primary object of the present inven- 
tion lies in the rapid re-issue of the right to use, for the 
resource management server when the crash occurs in 
the current processing server. 

Figure 8 is basic block diagram of an issue process- 
ing system according to one aspect of the present in- 
vention. The same reference numbers used in Fig. 1 are 
attached to the components in this drawing. As ex- 
plained above, the client 1 sends a message for request- 
ing a service to the processing server. The processing 
server 2a is provided as a current server The current 



processing server 2a requests the service to the re- 
source management server, and imparts the resulting 
processing, which is performed in the resource manage- 
ment server, to the client 1 . The processing server 2b is 
s provided as a spare processing server. When the crash 
occurs in the current processing server 2a, the process- 
ing operation is transferred from the current processing 
server 2a to the spare processing sever 2b. 

The resource management server 3a is provided as 
io a current management server. The resource manage- 
ment server 3a acquires the right to use from the nuclear 
program 4 in accordance with the request of the service 
and issues a corresponding right to use to the current 
processing server 2a. The resource management serv- 
es er 3b is provided a space management server. The re- 
source management server 3a has a re-transmission 
detection means 30, a registration issue means 31, a 
discriminator addition means 32, and a right to use ex- 
amination means 33. These means are explained in de- 
tail below. The nuclear program 4 is provided for check- 
ing the operation of the processing servers and for man- 
aging (for example, registering, cancelling, checking, 
etc.) the right to use. Accordingly, the nuclear program 
4 has management means 40 for the right to use the 
resource. 

The re-transmission detection means 30 examines 
the message to determine whether it is a re-transmitted 
message in accordance with a discriminator attached to 
the message. In this case, the message is transmitted 
from the current processing server 2a and includes the 
request for acquiring the resource. The registration is- 
sue means 31 acquires the right to use in response to 
the message, registers the acquired right to use in the 
management means 40, and issues the right to use to 
the current processing server 2a. Further, the registra- 
tion issue means 31 cancels the registered right to use 
in accordance with the information from the processing 
server 2a and the nuclear program 4. The discriminator 
addition means 32 attaches the discriminator of the 
message to the right to use when the registration issue 
means 31 registers the right to use into the management 
means 40. The right to use examination means 33 ex- 
amines the right to use to determine whether it is already 
issued and registered in accordance with the message 
of the re-transmission. This examination is performed 
with reference to the discriminator in the management 
means 40 at the time when the re-transmission detec- 
tion means 30 detects that the message is a re-trans- 
mitted one. 

Figure 9 is a view for explaining the processing 
steps of the structure shown in Fig. 8. As explained 
above, when the resource management server 3a judg- 
es that the message of the request for acquiring the re- 
source from the current processing server 2a is not the 
re-transmitted message in accordance with the 
processing at the re-transmission detection means 30, 
the resource management server 3a acquires the re- 
quested right to use. The resource management server 



25 



30 



35 



40 



45 



50 



5 



9 



EP0 459 912B1 



10 



3a registers the acquired right to use into the right to use 
management means 40, and issues that acquired right 
to use to the current processing server 2a. Further, the 
resource management server 3a adds the discriminator 
corresponding to the issued message to the right to use 
to be registered. 

When the resource management server 3a judges 
that the message of the request is the re-transmitted 
message in accordance with the processing at the re- 
transmission detection means 30, -the -resource man- 
agement server 3a judges whether the corresponding 
right to use is registered and issued in accordance with 
the processing at the right to use examination means 
33. When the right to use is already registered and is- 
sued, the resource management server 3a ignores the 
previous right to use in accordance with the processing 
at the registration issue means 31 , and registers a new 
right to use after addition of the discriminator, then is- 
sues a new right to use to the spare processing server 
2b. 

In this case, when the right to use is not yet regis- 
tered and issued, there are two causes in the crash, i. 
e., the crash at the resource management server itself 
or the crash at the current processing server itself. Ac- 
cordingly, the resource management server 3a again 
registers the right to use after the addition of the discrim- 
inator and issues a new right to use to the spare 
processing server 2b. 

As shown in Fig. 9, in the resource management 
server 3a, when the right to use is registered (4), the ID 
is added to the right to use (5), and, after the addition of 
the ID, the right to use is registered into the nuclear pro- 
gram 4 (6). The issue of the right to use and the result 
of the processing are imparted to the current processing 
server (7). When the crash occurs in the current 
processing server (4'), the processing operations trans- 
ferred to the spare processing server (6*) and the re- 
quest to the resource management server (7') is re- 
transmitted. When the resource management server 3a 
receives the re-transmission of message (8 1 ), it exam- 
ines the message and determines whether it is a re- 
transmitted message (9'). When the message is re- 
transmitted, the previously registered message is ig- 
nored (10') and a new right to use is registered (12'). 
Then the ID is added to the new right to use (13') and 
this right to use is registered into the nuclear program 4 
(14'). 

Figure 10 is a schematic block diagram of an issue 
processing system according to an embodiment of the 
present invention. In Fig. 10, reference numbers 5a and 
5b denote file name servers, and 6a and 6b denote file 
management servers. In this case, 5a and 6a are used 
as current systems, and 5b and 6b are used as spare 
systems. The file name server 5a has a file name man- 
agement means 50. The file management server 6a has 
a file access management means 60, a re-transmission 
message examination means 61 , a file right to use reg- 
istration/issue means 62, an ID addition means 63, a 



processing examination means 64, and a file right to use 
invalidation means 65. 

The client 1 issues the request for opening a file (be- 
low, file opening request) to the file name server 5a. The 

s file name server 5a defines one of file management 
servers 6a and issues a file opening request to the de- 
fined file management server 6a. Accordingly, the file 
name management means 50 is provided for managing 
the relationship between the file name and its location. 

to in the file management server 6a, the file access 
management means 60 is provided for performing an 
access processing to the file. The re-transmission mes- 
sage detection means 61 is provided for judging wheth- 
er the message of the file opening request is a re-trans- 

75 mitted message based on the discriminator attached to 
the message. The file right to use registration/issue 
means 62 is provided for performing the registration, the 
issue, and the cancellation ol the right to use. The ID 
addition means 63 is provided for adding the discrimi- 

20 nator to the message of the right to use of the file when 
the right to use of the file is registered. The processing 
examination means 64 is provided for judging whether 
the right to use a file is issued and registered. The file 
right to use invalidity means 65 is provided for making 

2S the right to use of the file invalid. 

Figure 11 is one example of a discriminator accord- 
ing to the present invention. A multi-request ID is used 
for requesting the opening of the file. A request counter 
is used for displaying the request number at the multi- 

30 request I D. A re-transmission counter is used for count- 
ing the number of the re-transmission of the same file 
opening request. Accordingly, the re-transmission mes- 
sage detection means 61 detects the re-transmission 
message when the number of the re-transmission coun- 

35 ter is indiscriminate. 

Figure 12A to 1 4B are flowcharts for explaining the 
processing of the present invention. Figures 12A and 
12B are flowcharts for explaining the processing in the 
file name server, Figures 13A and 13B are flowcharts 

40 for explaining the processing in the nuclear program, 
and Figures 14A and 14B are flowcharts for explaining 
the processing in the file management server. 

In Fig. 1 2A, the current file name server 5a receives 
the message of the file opening request from the client 

45 (step 1 ), refers to the file name management means 50 
therein, acquires the file management server 6a man- 
aging the corresponding file with which the file opening 
request exists (step 2), and sends the message of the 
file opening request to the corresponding file manage- 

so ment server 6a (step 3). Next, when the corresponding 
file management server 6a crashes (YES, in step 4), the 
message of the file opening request is re -transmitted 
from the file name server 5a (step 5), When the corre- 
sponding file management server 6a does not crash 

55 (NO, in step 4), the processing at the file management 
server 6a is replied to the file name server 5a after reg- 
istration of the file right to use in the file management 
server 6a (step 6). 
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In Fig. 1 2B, the spare file name server 5b receives 
the command of the transfer of the processing from the 
nuclear program 4 (step 1), detects the processing in 
hand therein (step 2), when the processing in hand ex- 
ists therein (YES, step 2), the message of the file open- 
ing request is re-transmitted from the spare file name 
server 5b to the corresponding file management server 
6a (step 3). Next, when the corresponding file manage- 
ment server 6a crashes (step 4, YES), the message of 
the file opening request is re -transmitted from the spare 
file name server 5b (step 5). When the corresponding 
file management server 6a does not crash (step 4, NO), 
the processing at the file management server 6a is re- 
plied to the spare file name server 5b after registration 
of the file right to use in the file management server 6a 
(step 6). 

In Fig. 13A : the nuclear program 4 always checks 
whether the operation of the current file name server 5a 
is crashed (step 1). When the current file name server 
5a crashes (YES, step 1), the nuclear program 4 com- 
mands the transfer of the processing to the spare file 
name server 5b. 

In Fig. 13B, the nuclear program 4 checks whether 
the right to use at the file management server 6a should 
be purged (step 1). When the crashed current file name 
server 5a has the right to use, the nuclear program 4 
sends the purging request to the file management sever 
6a so as to purge the corresponding right to use (step 2). 

In Fig. 14A, when the file management server 6a 
receives the purging request of the file right to use from 
the nuclear program 4, the file management server 6a 
judges whether the corresponding file right to use is val- 
id (step 1). When the corresponding file right to use is 
yet valid (YES, step 1 ), it is cancelled from the file man- 
agement server 6a based on the command of the nu- 
clear program 4 (step 2). 

In Fig. 14B, when the file management server 6a 
receives the message of the file opening request from 
the file name server 5a (step 1), the file management 
server 6a checks the value of the re-transmission coun- 
ter of the discriminator attached to the message, exam- 
ines whether the message is re-transmitted message, 
and records the result of the examination to transfer the 
processing to the spare file management server 6b (step 
2). Next, based on the result of the examination, when 
the message is not re-transmitted one (NO. in step 3), 
the file management server 6a attaches the discrimina- 
tor to the corresponding file right to use and registers 
the file right to use into a memory area of the nuclear 
program 4 (step 4). In this case, the file right to use is 
registered with the discriminator. After above steps, the 
registered file right to use is transmitted to the file name 
server 5a to which the file opening request is issued 
(step 5). 

When the message is a re-transmission (YES, in 
step 3), the file management server 6a examines wheth- 
er the file right to use is already registered in accordance 
with the previous message of the file opening request 



(step 6). When the file right to use is not registered there- 
in (NO, in step 7), the addition of the ID and registration 
of the right to use are performed (step 4). When the file 
right to use is already registered therein (YES, step 7) : 
s the corresponding file right to use is cancelled (step 8), 
and the addition of the ID and registration of the right to 
use are performed (step 4). 

Figure 1 5 is a view for explaining the processing op- 
eration in the system shown in Fig. 10. Each step of this 
to drawing is already explained in the previous drawings. 
Accordingly the detailed explanations are omitted in this 
stage. Briefly, the tile management server according to 
the present invention can rapidly issue the file right to 
use to the spare file name server 5b even if the file man- 
is agement server 6a receives the request of the file right 
to use from the spare file name server 5b before the re- 
ception of the purging request from the nuclear program 
4. 

Figure 16 is a schematic block diagram of a data 
20 processing system having a global service program 
based on a fault-tolerant method. In Fig. 16 : AP denotes 
a application program, GS2 denotes a global service 
program used as a current system, GS3 denotes a glo- 
bal service program used as a spare system, GS4 de- 
notes a file global service program, FL denotes a file 
provided in an external storage device. 

As explained above, in a data processing system , 
a global service program is provided for controlling all 
resources in the system, and a predetermined service 
is provided to an application program with reference to 
filed information in accordance with processing of the 
global service program. In general, the global service 
program has a current system and a spare system to 
perform a fault-tolerant method. According to this fault- 
tolerant method, the application program does not de- 
tect the crash of the global service program. In this fault- 
tolerant method, it is necessary for the spare global 
service program to rapidly open the file when the crash 
occurs in the current global program. 

As shown in the drawing, in a normal processing 
operation, when the predetermined processing is re- 
quested from the application program AP to the global 
service program, the current GS2 transmits a file open- 
ing request to the file GS4. The file GS4 performs a file 
opening processing so that the file FL is opened by the 
file GS4. Accordingly, the current GS2 can process the 
request from the application program. 

When the crash occurs in the current GS2, the 
processing request from the application program is 
transferred from the current GS2 to the spare GS3, and 
the spare GS3 transmits the file opening request to the 
file GS4 so that the spare GS3 can process the request 
from the application program. Accordingly, the applica- 
tion program does not detect the crash of the global 
service program. 

Figure 17 is a view for explaining processing oper- 
ation when the crash occurs in the current GS2. When 
the crash of the current GS2 is detected by a supervisor 
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(in this case, a supervisor corresponds to the nuclear 
program 4 in Fig. B), the processing request is . trans- 
ferred from the current GS2 to the spare GS3 and the 
file is opened by the file GS4. In the normal crash 
processing operation, the supervisor transmits the mes- 
sage of request for withdrawing the file opening environ- 
ment to the file GS4, and the file GS4 performs the with- 
drawal of the file opening environment as to the current 
GS2 based on the message from the supervisor. In gen- 
eral, the withdrawing operation of the file, opening envi- 
ronment in the file GS4 is simultaneously performed with 
the file opening request in the spare GS3. Accordingly, 
when the file opening request is issued from the spare 
GS3 to the file GS4 before the withdrawing operation is 
completed in the file GS4, the competition of the request 
occurs in the file FL so that the file GS4 outputs an "open 
error" to the spare GS3. 

Figure 18 is a schematic block diagram of an issue 
processing system according to another aspect of the 
present invention. In Fig. 18, reference number 10 de- 
notes a data processing means, 20 a file, 30a a current 
service producing means, 30b a spare service produc- 
ing means, 40a a current access processing means, 
40b a spare access processing means, and 50 a dis- 
criminator allocating means. 

The file 20 manages data necessary for the data 
processing operation in the data processing means 10. 
The current service producing means 30a is started in 
response to the request of the service from the data 
processing means 10, and produces the predetermined 
service to the data processing means 10. In general, a 
plurality of service producing means 30a are provided 
in the system. The spare service producing means 30b 
is provided for transferring the processing from the cur- 
rent service producing means 30a when the crash oc- 
curs in the current service producing means 30a. The 
access processing means 40a is started in response to 
the request of the opening of the file from the current/ 
spare service producing means 30a and 30b, and per- 
forms the service of the resource management in the 
file 20. The discriminator allocating means 50 uniformly 
allocates the discriminator to each current service pro- 
ducing means 30a, and also allocates the discriminator 
to the corresponding spare service producing means 
30b. 

As shown in the drawing, the service producing 
means 30a has an opening request issuing means 31a 
and a discriminator informing means 32a. The opening 
request issuing means 31a issues the opening request 
of the file 20 to the access processing means 40a. The 
discriminator informing means 32a informs the discrim- 
inator allocated by the discriminator allocating means 
50 to the access processing means 40a when the open- 
ing request is issued from the opening request issuing 
means 31 a. 

The access processing means 40a has an opening 
request receiving means 41 a, an opening processing 
means 42a, a discriminator managing means 43a, and 



an opening environment withdrawal means 44a. The 
opening request receiving means 41a receives the file 
opening request issued from the opening request issu- 
ing means 31a. The opening processing means 42a 
5 performs the opening processing to the file 20. The dis- 
criminator managing means 43a manages the discrim- 
inator, which is informed from the discriminator inform- 
ing means 32a, until the withdrawal of the file opening 
environment is completed. The opening environment 
- 10 withdrawing means 44a withdraws the file opening en- 
vironment already provided. 

In the present invention, the discriminator informing 
means 32a informs the discriminator allocated by the 
discriminator allocating means 50 to the access 

is processing means 40a when the opening request issu- 
ing means 31 a issues the file opening request to the ac- 
cess processing means 40a. When the opening request 
receiving means 41a receives the file opening request 
and the discriminator Irom the opening request issuing 

20 means 31a, the opening request receiving means 41a 
starts the opening processing means 42a and registers 
the discriminator into the discriminator managing means 
43a. The opening processing means 42a sets the file 
opening environment therein, issues an I/O command 

25 to the file 20, and refers to the content of the file 20. 

The discriminator managing means 43a manages 
the discriminator until the processing at the opening 
processing means 42a is finished and thB withdrawal of 
the file opening environment is completed. In the above 

30 steps, when the crash is detected in the current service 
producing means 30a, the processing is transferred 
from the current service producing means 30a to the 
spare service producing means 30b. In the above trans- 
fer operation, when the opening request issuing means 

35 31 b must issue the file opening request to the access 
processing means 40a, the discriminator informing 
means 32b informs the discriminator allocated by the 
discriminator allocating means 50 to the access 
processing means 40a. 

40 When the opening request receiving means 41 a re- 
ceives the file opening request from the spare service 
producing means 30b, the opening request receiving 
means 41a searches the discriminator managing 
means 43a so as to determine whether or not the same 

^5 discriminator as informed from the spare service pro- 
ducing means 30b is provided therein. 

When the opening request receiving means 41 a de- 
tects that the same discriminator is not managed in the 
discriminator managing means 43a, the opening re- 

so quest receiving means 41 a starts the opening process- 
ing means 42a so as to perform the file opening request 
from the spare service producing means 30b. When the 
opening request receiving means 41a detects that the 
same discriminator is managed in the discriminator 

55 managing means 43a, the opening request receiving 
means 41a judges whether the withdrawal command of 
the file opening environment, which is transmitted from 
a supervisor, is input yet from the supervisor. In this 
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case, the opening request receiving means 41a imme- 
diately starts the opening environment withdrawing 
means 44a to forcibly withdraw the file opening environ- 
ment from the opening environment withdrawing means 
44a. 

As explained above, in the present invention, when 
the spare service producing means 30b issues the file 
opening request to the access processing means 40a, 
the access processing means 40a judges whether or not 
the file opening environment, which is already set in the 
discriminator managing means 43a in response to the 
file opening request from the spare service producing 
means 30b, is withdrawn. When the file opening envi- 
ronment is not yet withdrawn, the withdrawal is forcibly 
performed in the opening environment withdrawing 
means 44a so that it is possible to prevent an opening 
error in the data processing system. 

Figure 1 9 is a schematic block diagram according 
to one embodiment of the second aspect of the present 
invention shown in Fig. 18. In Fig. 19, the same refer- 
ence letters as used in Fig. 16 are attached to the same 
components in this drawing. GS1 denotes a discrimina- 
tor, CT denotes a control table, and GSP denotes a glo- 
bal service program for managing a start-up of the global 
service program. The control table CT for storing dis- 
criminators is provided in memory area in the file GS4 
to manage the file opening environment. 

The GSP is provided for sorting the current G S2 and 
the spare GS3. Further the GSP allocates the discrim- 
inator to the current GS2 when starling the cu rrent GS2, 
and also allocates the same discriminator as that of the 
current GS2 to the spare GS3 when starting the spare 
GS3. Accordingly, the discriminator GS1 is allocated to 
the current GS2, and also allocated to the spare GS3. 
The current GS2 and the spare GS3 inform the allocated 
discriminator to the file GS4 when issuing the file open- 
ing request to the file GS4. 

Figure 20 is a flowchart for explaining the process- 
ing operation in the file GS4. In Fig. 20, first, the file GS4 
receives the file opening request and the discriminator 
(step 1). Next, the file GS4 judges whether the same 
discriminator as received above is already set in the 
control table CT (step 2). 

When the same discriminator is set in the control 
table CT (YES)(i.e., when the file opening request at the 
step 1 indicates the request from the spare GS3) ; the 
file GS4 forcibly withdraws the file opening environment 
and the I/O command (step 3). 

When the same discriminator is not set in the control 
table CT (NO) (i.e., when the file opening request at the 
step 1 indicates the request from the current GS2, or 
when the file opening request indicates the request from 
the spare GS3 after the opening environment of the cur- 
rent GS2 is already withdrawn), the file GS4 performs 
the opening process (step 4). The file GS4 sets the re- 
ceived discriminator in the control table (step 5). Accord- 
ingly, when the crash does not occur in the current GS2, 
the discriminator of the current GS2 in the control table 



CT is held until the access processing to the file is com- 
pleted. 

Figure 21 is a view for explaining the processing op- 
eration according to the present invention. As shown in 
5 the drawing, when the file opening request is issued 
from the spare GS3 t the file GS4 forcibly withdraws the 
file opening environment which is set in response to the 
file opening request from the current GS2. Accordingly, 
it is not necessary to output the open error from the file 
GS4 to the spare GS3. - - - - 



Claims 

1. An issue processing system for a right to use a re- 
source in a data processing system having a global 
service program based on a fault-tolerant method 
which provides a current processing server (2a) and 
a spare processing server (2b), each processing 
server (2a, 2b) performing predertermined data 
processing requested from a client (1 ) based on a 
resource acquired a current resource management 
server (3a), and the predetermined data processing 
being transferred from the current processing serv- 
er (2a) to the spare processing server (2b) based 
on a command of a transfer from a nuclear program 
(4) when a crash occurs in the current processing 
server (2a), characterized in that the resource man- 
agement server (3a) comprises : 

re-transmission examination means (30) for ex- 
amining a message from the processing server 
and determining whether or not it is a re-trans- 
mitted message based on a discriminator at- 
tached to the message for requesting acquire- 
ment of the right to use the resource; 
discriminator addition means (32) for adding 
the discriminator to the message for requesting 
issuance of the right to use when that right to 
use is registered; and 

right to use examination means (33) for exam- 
ining whether the right to use is already regis- 
tered on based on a previous message by re- 
ferring to the discriminator attached by the dis- 
criminator addition means (32), when the mes- 
sage is indicated as the re-transmission mes- 
sage based on the detection of the re-transmis- 
sion examination means (30); 
wherein, when the examination means (33) 
judges that the right to use is already regis- 
tered, the above registered right to use is inval- 
idated, and a new right to use is registered into 
the nuclear program (4) and the new right to 
use is issued to the spare processing server 
(2b). 

2. An issue processing system as claimed in claim 1 , 
wherein the discriminator transmitted from the 
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processing server (2) to the resource management 
server (3) comprises a unique discriminator and a 
re-transmission number discriminator for counting 
the number ot the re-transmission, and the re-trans- 
mission examination means (30) judges whether 5 
the message is the re-transmitted message based 
on the re-transmission count discriminator. 

3. An issue processing system as claimed in claim 2, 
wherein the unique discriminator comprises a multi- to 
request discriminator and an issue number count- 
ing discriminator, the multi-request discriminator 
being used tor the request of acquirement to the 
same resource, and the issue number counting dis- 
criminator indicating the number of issues of the i$ 
multi-request discriminator. 

4. An issue processing system for a right to use a re- 
source in a data processing system having a global 
service program based on a fault-tolerant method so 
providing a current service producing means (30a) 
and a spare service producing means (30b), each 
service producing means performing a predeter- 
mined data processing requested from a data 
processing means (10) based on an access 2$ 
processing means (40a), and the predetermined 
data processing being transferred from the current 
service producing means (30a) to the spare service 
producing means (30b) based on a command of 
transfer from a supervisor when a crash occurs in 30 
the current service producing means, characterized 

in that the system comprises : 

a discriminator allocating means (50) for allo- 
cating the same discriminator to the current 3S 
(30a) and spare (30b) service producing 
means; and 

discriminator informing means (32a ; 32b) asso- 
ciated with each of the current (30a) and the 
spare (30b) service producing means for in- *o 
forming the access processing means (40a) of 
the discriminator allocated by the discriminator 
allocating means (50), for processing a file ac- 
cess when the service producing means issues 
a file opening request, 45 
wherein the access processing means (40a) 
manages the discriminator until the withdrawal 
of the opening environment is completed, the 
access processing means (40a) being in- 
formed of the discriminator from the current so 
service producing means (30a) at the time of 
the file opening request therefrom, further, 
when the access processing means (40a) man- 
ages the same discriminator from the spare 
service producing means (30b) as that from the ss 
current service processing means, at the time 
of the file opening request, the opening envi- 
ronment defined by the discriminator is forcibly 



withdrawn. 

5. An issue processing method as claimed in claim 4, 
wherein the discriminator allocating means (50) al- 
locates the same discriminator to both service pro- 
ducing means when the current and spare service 
producing means (30a, 30b) are started. 



PatentansprOche 

1. Ausgabeverarbeitungssystem fur eine Berechti- 
gung zur Verwendung eines Betriebsmittels in ei- 
nem Datenverarbeitungssystem mit einem globa- 
len Serviceprogramm, basierend auf einem Fehler- 
toferanzverfahren, welches einen laufenden Verar- 
beitungsserver (2a) und einen E rsatz- Verarbei- 
tungsserver (2b) zur Verfugunggestellt, wobeijeder 
Verarbeitungsserver (2a, 2b) eine vorbestimmte 
Datenverarbeitung durchfuhrt, die von einem Re- 
quester (1) basierend auf einem Betriebsmittel an- 
gefragt wurde, welches von einem laufenden Be- 
triebsmittelmanagementserver (3a) erworben wur- 
de, und wobei eine vorbestimmte Datenverarbei- 
tung von einem laufenden Verarbeitungsserver (2a) 
auf den Ersatz- Verarbeitungsserver (2b) basierend 
auf einem Ubertragungsbef ehl von einem Kempro- 
gramm (4) aus ubertragen wird, wenn ein Absturz 
bzw. Kollision in dem laufenden Verarbeitungsser- 
ver (2a) auftritt, dadurch gekennzeichnet, da3 der 
Betriebsmittelmanagementserver (3a) folgendes 
aufweist: 

eine Rucksendung-Prufeinrichtung (30) zum 
Uberprufen einer Nachricht von dem Verarbei- 
tungsserver und urn zu bestimmen, ob diese ei- 
ne ruckgesendete Nachricht ist oder nicht, ba- 
sierend auf einem Diskriminator, der an die 
Nachricht angeheftet ist, urn nach dem Erwerb 
der Berechtigung der Verwendung des Be- 
triebsmittels anzufragen; 
eine Diskriminator-Addiereinrichtung (32) zum 
Hinzufugen des Diskriminators zur Nachricht, 
um nach einer Ausgabe der Verwendungsbe- 
rechtigung anzufragen, wenn diese Verwen- 
dungsberechttgung registries ist; und 
eine Verwendungsrecht-Prufeinrichtung (33), 
zum Prufea ob das Verwendungsrecht bereits 
registriert wurde, und zwar basierend auf einer 
fruheren Nachricht durch Bezugnahme auf den 
Diskriminator, der durch die Diskriminator-Ad- 
diereinrichtung (32) angefugt worden ist, wenn 
die Nachricht als eine ruckgesendete bzw wie- 
dergesendete Nachricht angezeigt wird, basie- 
rend auf der Detektion durch die Rucksendung- 
Prufeinrichtung (30); 

wobei dann, wenn die Prufeinrichtung (33) be- 
urteilt, daf) das Verwendungsrecht bereits regi- 
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striert wurde, das oben erwahnte registrierte 
Verwendungsrecht unguttig gemacht wird und 
ein neues Verwendungsrecht in dem Kernpro- 
gramm (4) registriert wird und das neue Ver- 
wendungsrecht an den Ersatz-Verarbeitungs- s 
server (2b) ausgegeben wird. 

2. Ausgabeverarbeitungssystem nach Anspruch 1. 
bei dem der Diskriminator, welcher von dem Verar- 
beitungsserver (2) zu_dem Betriebsmittelmanage- io 
mentserver (3) ubertragen wurde, einen einmaligen 
Diskriminator und einen Rucksendung-ZahlDiskri- 
minator aufweist, urn die Zahl von Rucksendungen 
bzw Wiedersendungen zu zahlen und bei dem die 
Rucksendung-Prufeinrichtung (30) beurteilt, ob die is 
Nachricht die ruckgesendete Nachricht ist, basie- 
rend auf dem Rucksendung-Zahlwert-Diskrimina- 

tor. 

3. Ausgabeverarbeitungssystem nach Anspruch 2, 20 
bei dem der einmalige Diskriminator einen Vielfach- 
anfrage-Diskriminator und einen Ausgabeanzahl- 
Zahl-Diskriminator aufweist, wobei der Vielfachan- 
frage-Diskriminator fur die Anfrage nach Erwerb 
des gleichen Betriebsmrttels verwendet wird und 25 
wobei der Ausgabeanzahl-Zahl-Diskriminator die 
Zahl der Ausgaben des Vielfachanfrage-Diskrimi- 
nators angibt. 

4. Ausgabeverarbeitungssystem fur die Berechtigung 30 
der Verwendung eines Betriebsmittels in einem Da- 
tenverarbeitungssystem, welches ein globales Ser- 
viceprogramm umfaBt, basierend auf einem Fehler- 
toleranzverfahren, welches eine laufende Service- 
Erzeugungseinrichtung (30a) und eine Ersatz -Ser- 3$ 
vice-Erzeugungseinrichtung (30b) zur Verfugung 
stellt, wobei jedes Service-Erzeugungseinrichtung 
eine vorbestimmte Datenverarbeitung durchfuhrt, 

die von einer Datenverarbeitungseinrichtung (10) 
angefragt wurde, basierend auf einer Zugriffs-Ver- *o 
arbeitungseinrichtung (40a) und bei dem die vorbe- 
stimmte Datenverarbeitung von der laufenden bzw. 
momentanen Se rvice-E rzeugungseinrichtung 
(30a) auf die Ersatz -Service-Erzeugungseinrich- 
tung (30b) ubertragen wird, und zwar basierend auf *s 
einem Ubertragungsbefehl von einer Oberwa- 
chungseinrichtung, wenn ein Absturz bzw. Kollision 
in der laufenden Service-Erzeugungseinrichtung 
auftritt, dadurch gekennzeichnet, da(3 das System 
folgendes aufweist: so 

eine Diskriminator-Zuordnungseinrichtung (50) 
zum Zuordnen des gleichen Diskriminators zu 
der laufenden (30a) und der Ersatz(30b)-Ser- 
vice-E rzeugungseinrichtung; und ss 
eine Diskriminator-lnformiereinrichtung (32a, 
32b), die jeder der laufenden (30a) und der Er- 
satz(30b)-Service-Erzeugungseinrichtung zu- 



geordnet ist, um die Zugriffsverarbeitungsein- 
richtung (40a) uber den Diskriminator zu infor- 
mieren, der durch die Diskriminator-Zuord- 
nungseinrichtung (50) zugeordnet wurde, um 
einen Dateizugriff zu verarbeiten, wenn die 
Service-Erzeugungseinrichtung eine Dateioff- 
nungsanfrage ausgibt, 

wobei die Zugritfsverarbeitungseinrichtung 
(40a) den Diskriminator managt, bis die Ruck- 
nahme der Offhungsgrundlagen vervollstan- 
digt ist und wobei die Zugriffsverarbeitungsein- 
richtung (40a) von der laufenden Service-Er- 
zeugungseinrichtung (30a) uber den Diskrimi- 
nator informiert wird, und zwar zu dem Zeit- 
punkt der Dateioffnungsanfrage von dieser, 
und wobei ferner dann, wenn die Zugriffsverar- 
beitungseinrichtung (40a) den gleichen Diskri- 
minator von der Ersatz-Service-E rzeugungs- 
einrichtung (30b) wie derjenigen von der lau- 
fenden Service-Erzeugungseinrichtung ma- 
nagt, zu dem Zeitpunkt der Dateioffnungsanfra- 
ge, die Offnungsgrundlagen, die durch den Dis- 
kriminator festgelegt sind, zwangsweise zu- 
ruckgezogen werden. 

5. Ausgabeverarbeitungsverfahren nach Anspruch 4, 
bei dem die Diskriminator- Zuordnungseinrichtung 
(50) den gleichen Diskriminator beiden Service-Er- 
zeugungseinrichtungen zuordnet, wenn die mo- 
mentane bzw. laufende und die Ersatz-Service-Er- 
zeugungseinrichtung (30a, 30b) gestartet werden. 

Revendications 

1 . Systeme de traitement de 66 livrance du droit d'uti- 
liser une ressource dans un systeme de traitement 
de donnees possedant un programme de service 
global s'appuyant sur un procede" tolerant vis-a-vis 
des defauts qui foumit un serveur de traitement 
courant (2a) et un serveur de traitement de reserve 
(2b), chaque serveur de traitement (2a, 2b) eflec- 
tuant un traitement de donnees predetermine qui 
est demande par un client (1 ) sur la base d'une res- 
source acquise par un serveur de gestion de res- 
sources courant (3a), le traitement de donnees pre- 
determine etant transfe're du serveur de traitement 
courant (2a) au serveur de traitement de reserve 
(2b) sur la base d'une instruction de transfert venant 
d'un programme de noyau (4) lorsqu'une panne se 
prod u it dans le serveur de traitement courant (2a) , 
caracterise en ce que le serveur de gestion de res- 
sources (3a) comprend : 

un moyen d'examen de reemission (30) servant 
a examiner un message venant du serveur de 
traitement et a determiner s'il s'agit ou non d'un 
message reemis sur la base d'un discrimina- 
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teur lie au message pour demander ('acquisi- 
tion du droit d'utilisation de la ressource ; 
un moyen d'addition de discriminates (32) ser- 
vant a ajouter le discriminateur au message 
afin de demander la delivrance du droit d'utili- s 
sation lorsque ce droit d'utilisation est 
enregistre ; et 

un moyen d'examen de droit d'utilisation (33) 
servant a examiner si le droit d'utilisation est ou 
non deja enregistre sur la base d'un message io 
precedent par reference au discriminateur lie 
par le moyen d'addition de discriminateur (32), 
lorsque le message est indique comme etant le 
message de Remission sur la base de la de- 
tection faite par le moyen d'examen de reemis- is 
sion (30) ; 

ou. lorsque le moyen d'examen (33) determine 
que le droit d'utilisation est deja enregistre, le 
droit d'utilisation enregistre ci-dessus indique 
est invalide, et un nouveau droit d'utilisation est so 
enregistre dans le programme de noyau (4) et 
le nouveau droit d'utilisation est deiivre au ser- 
veur de traitement de reserve (2b). 

2. Systeme de traitement de delivrance selon la re- 2S 
vendication 1, ou le discriminateur emis par le ser- 
veur de traitement (2) a destination du serveur de 
gestion de ressources (3) comprend un discrimina- 
teur unique et un discriminateur de nombre de ree- 
missions servant a compter le nombre des reemis- 30 
sions, et le moyen d'examen de Remission (30) de- 
termine si le message est le message reemis sur la 
base du discriminateur de comptage de reemis- 
sions. 

3S 

3. Systeme de traitement de delivrance selon la re- 
vendication 2, ou le discriminateur unique com- 
prend un discriminateur multi-demande et un discri- 
minateur de comptage de nombre de deiivrances, 

le discriminateur multi-demande etant utilise pour to 
lademande d'acquisition d'une meme ressource, et 
le discriminateur de comptage de nombre de deli- 
vrances indiquant le nombre de delivrances du dis- 
criminateur multi-demande. 

45 

4. Systeme de traitement de delivrance du droit d'uti- 
liser une ressource dans un systeme de traitement 
de donnees ayant un programme de service global 
s'appuyant sur un procede tolerant vis-a-vis des de- 
fauts qui fournit un moyen de production de service so 
courant (30a) et un moyen de production de service 

de reserve (30b), chaque moyen de production de 
service effectuant un traitement de donnees prede- 
termine qui est demande depuis un moyen de trai- 
tement de donnees (1 0) sur la base d'un moyen de ss 
traitement d'acces (40a), le traitement de donnees 
predetermine etant transfere du moyen de produc- 
tion de service courant (30a) au moyen de produc- 



tion de service de reserve (30b) sur la base d'une 
instruction de transfer! venant d'un supervises 
lorsqu'une panne a lieu dans le moyen de produc- 
tion de service courant, caracterise en ce que le 
systeme comprend : 

un moyen d'affectation de discriminateur (50) 
servant a affecter le meme discriminateur aux 
moyens de production de service courant (30a) 
et de reserve (30b) ; et 

un moyen de communication de discriminateur 
(32a, 32b) respectivement associe a chacun 
des moyens de production de service courant 
(30a) et de reserve (30b), et servant a informer 
le moyen de traitement d'acces (40a) du discri- 
minateur affecte par le moyen d'affectation de 
discriminateur (50), afin de traiter un acces a 
un fichier lorsque le moyen de production de 
service deiivre une demande d'ouverture de fi- 
chier, 

ou le moyen de traitement d'acces (40a) gere 
le discriminateur jusqu'a ce que le retrait de 
I'environnement d'ouverture soit acheve, le 
moyen de traitement d'acces (40a) etant infor- 
me du discriminateur par le moyen de produc- 
tion de service courant (30a) au moment de la 
demande d'ouverture de fichier venant de ce- 
lui-ci, et : par ailleurs, lorsque le moyen de trai- 
tement d'acces (40a) gere le meme discrimina- 
teur, provenant du moyen de production de ser- 
vice de reserve (30b), que celui venant du 
moyen de traitement de service courant, au 
moment de la demande d'ouverture de fichier, 
I'environnement d'ouverture defini par le discri- 
minateur est retire de force. 

5. Systeme de traitement de delivrance selon la re- 
vendication 4, ou le moyen d'affectation de discri- 
minateur (50) affecte le meme discriminateur aux 
deux moyens de production de service lorsque les 
moyens de production de service courant et de re- 
serve (30a : 30b) sont demands. 
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